[New Package] Add FreeIPA integration

[Oddly]

Summary

Initial release of the FreeIPA (Red Hat IdM) integration. Collects security-relevant logs from five FreeIPA subsystems using filestream input: Kerberos KDC authentication events, 389 Directory Server access and error logs, Dogtag CA signed audit events, and IPA JSON API operations. Includes five ES|QL alerting rule templates that activate on Stack 9.2+, three optional transforms for cross-event LDAP correlation, and comprehensive ECS field mappings including x509 certificate fields and rule.name for policy objects. Dashboards will follow in a separate PR.

Changes

• Five data streams: kdc, directory_access, directory_errors, ca_audit, ipa_api
• Ingest pipelines with full ECS mapping, GeoIP enrichment on source IPs, and tagged processors throughout
• KDC pipeline handles AS_REQ/TGS_REQ with constrained delegation (S4U2Proxy) support, maps to source.user/user.target for delegation events
• Directory access pipeline parses all LDAP operation types (BIND, SRCH, MOD, ADD, DEL, CMP, EXT, MODRDN, ABANDON, conn=Internal) with wtime/optime/etime extraction and unindexed search detection
• CA audit pipeline parses Dogtag signed audit log with certificate lifecycle tracking, CRL metrics (crl_number/crl_size), and ECS x509 field mapping (file.x509.serial_number, subject/issuer distinguished_name)
• IPA API pipeline extracts target entities and maps to ECS fields per command family: user.target.name, group.name, host.name, rule.name (sudorule/hbacrule), related.hosts (DNS/service), with per-family event.category refinement
• Five alerting rule templates: replication errors, unindexed LDAP searches, LDAP high latency, API error spike, CA connection failures
• Three optional transforms (latest_bind, latest_connection, latest_auth) with lookup-mode destination indices for ES|QL LOOKUP JOIN enrichment in detection rules
• 100% pipeline branch coverage across all data streams, zero dead paths

Testing

• Deployed on two FreeIPA 4.11 servers (Rocky Linux 9, primary + replica) with Elastic Agent 8.19 enrolled via Fleet
• All five data streams confirmed receiving live data (589 KDC events, 11k directory access, 1.6k directory errors, 564 CA audit, 73 IPA API)
• All defined fields populated with correct types in indexed data — zero type mismatches, zero missing fields
• All five alerting rule ES|QL queries executed against live data and returned correct results:
  • Replication errors: triggered with synthetic replication bind failures
  • Unindexed searches: triggered by searching on non-indexed attributes (roomNumber, carLicense)
  • LDAP high latency: query valid, correctly silent on healthy system (p95 = 7ms vs 5s threshold)
  • API error spike: triggered with user_show calls for nonexistent users
  • CA connection failures: caught 48 real ConnectException events from CA startup
• 24 of 27 detection rules confirmed firing against live data, 0 false positives
• Pipeline tests pass 18/18 for all data streams covering all operation types and edge cases
• elastic-package check passes (lint + build), full_review passes with 0 errors/0 warnings

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[botelastic]

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

[Oddly]

It would surely be nice to finally have FreeIPA in our SIEM. Why isn't this a priority?